Ubiquiti USG Remote User VPN RADIUS Authentication

The following steps will setup Windows Server 2012 R2 RADIUS authentication via Network Policy Server (NPS) with your Ubiquiti UniFi Security Gateway (USG) for a USG Remote User VPN. This will allow users to use their current Active Directory Domain Services (AD DS) credentials to authenticate to the Virtual Private Network (VPN).

I am using the UniFi controller version 5.4.14 hosted in Microsoft Azure on a Linux Server with PostFix for alerting.

Step 1: Configure Windows NPS Server

1. From the Server Manager Dashboard, install the Network Policy and Access Server role using Add Roles and Features accepting all defaults.
2. Once installed,  open the Network Policy Server Administrator Tool. Expand the RADIUS Clients and Servers, then right Click on RADIUS Clients and click New.
   
3. Give the USG router a Friendly Name. Type in the IP Address of the inside interface of the USG on the same network as the Windows Server. (This is the IP that the RADIUS requests will come from.) Click the Generate radio button, then click the generate button. Copy this Shared Secret to be pasted later. Click OK. 
4. In the Network Policy Server window, expand Policies, right click on Network Policies, and then click New.
   
5. Enter a policy name and leave Type of Network Access Server as Unspecified. Click on Next.
   
6. In Specify Conditions click Add.. and then select Windows Group, and pick the AD Group you want to use to allow VPN access.  (If you have not already then you will need to add all users who will be accessing the VPN into a seperate group.) Click Add… then Add Groups… which brings up the typical AD search box. Type in the name of the VPN Windows Group and click on OK. Click OK again. Click on Next
   
7. Leave the Specify Access Permissions at the defaults (Access Granted, Dial-in box unchecked). Click Next.
8. Uncheck all authentication methods other than MS-CHAPv2. Click on Next.
   
9. Accept the defaults under Configure Constraints. Click Next.
10. Leave all setting at the default on this page except for under Encryption. Uncheck everything except for MPPE 128-bit. Click Next.
11. Check your settings on the last page. Click Finish.
    
12. Finally, move the new policy above the two default policies in the list by right clicking and choosing Move  Up.

Step 2: Configure the USG Remote User VPN

1. To create the remote access network, in the UniFi controller, go to Settings, then Networks, and click Create New Network, give the network a name and select Remote User VPN.
   
2. Fill in the appropriate Gateway/Subnet information for your environment. Make sure it is not the same as any of your current networks.
3. Add Manual DNS servers, if required for your environment.
4. Click on Create New RADIUS Profile.
5. Give the Profile a name, enter in the IP address of the Windows Server 2012 R2 server that will be used for RADIUS authentication and paste in the generated shared secret.
6. Click Save. Click on Save again.

This allows easy access from Windows default VPN connections to network assets behind the USG device.

Hyper-V Networking Problems

I found a series of keys in the registry that I could delete to get rid of the adapters.  I went back in the registry to see if the root folder was still there but it's gone so Unfortunately I'm not sure what it was called but it's located under:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root


If you search for the exact name of the adapter in the registry you will see the keys...


The fun part is actually deleting them... there are lots of embedded keys and most of them have no owner or at least administrator doesn't have the ability to see it.  You have to take ownership of the key then add administrator to the permissions... then once u do that u will be able to see the keys under it and you can keep doing the same thing... there are about 50+ keys you need to delete (individually because of permissions!) in order to delete the entire set for the adapter.


I wish recursive claim ownership was possible to grab every key under it but unfortunately that does not work.. you need to claim ownership and add permission to a key in order to see what's under it.


Hyper-V causes way too many problems on my system... and after deleting 5 adapters from the registry in the way I described above I'm more than done with it.  I might try again on next release but I'm finding the vmware server 2.0 beta works VERY well on server 2008 so I'm using that for now.


Lösung: I used subinacl (a free microsoft tool) to change the permissions on the keys.



For each 0000, 0001, etc. in HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\VMS_MP\ run the following line (in a bat file or like):


"C:\Program Files (x86)\Windows Resource Kits\Tools\subinacl" /subkeyreg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\VMS_MP\0000 /grant=administrators=f


After this, the keys (0000, 0001, etc) can be deleted, and the intefaces will go away:)





Link: Microsoft SubInACL
http://www.microsoft.com/downloads/en/confirmation.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en